Adobe Flash has been on its deathbed for years. The company pulled the plug on Flash Player for mobile in 2012 and announced in 2017 that it would eventually kill flash for desktop operating systems as well.
Now the end is nigh.
Adobe has announced that Flash Player will officially reach the end of life on December 31, 2020.
At this point it’s unlikely that most people will miss it. There was a time when Flash was the de facto standard for developers who wanted to create multimedia content for the web including apps, games, and videos. But that time is long gone.
Few websites still use Flash, and most modern web browsers have phased out support for the technology… which earned a reputation over the years for being both a resource hog and for containing vulnerabilities that allowed attackers to infect your system with malware.
These days technologies including HTML 5, CSS, and JavaScript have largely replaced Flash. But some older Flash games, apps, and websites will likely never be updated. So some folks have been scrambling to archive tens of thousands of older Flash games to save a bit of internet history.
So in some ways… Flash will never really die.
In the way that probably matters most though, it’ll die at the end of this year.
I wonder if video streaming for webcam sex shows will be forced to change – livejasmin and such.
Sadly it will see the end of many superior flash programs.
The ones which remain alive now are generally used because the original flash software was created by smart people who understood what their users wanted, while their poor HTML5 replacements got developed by jobsworth programmers who, lacking the creator’s deep understanding of their users, sadly lost vital characteristics which made the original software superior, and thus left us with more modern successors that were just not worth using.
I wonder if CitiBank will update their virtual card number generator to use something else besides Flash. Maybe they’ll go with Bank of America and just stop supporting virtual card numbers all together because they determined it’s no longer useful with today’s technology… This would be too bad because I like using virtual card numbers to specify expiration dates and dollar limits.
I feel Adobe makes these announcements every so often just to stay relevant, I mean seriously, since its been so “depreciated” on “basically every website”, why has it taken so long to “kill it” when the longer in limps along in really any form has, at least as far as I can tell, zero benefits for anyone aside from the tiny amount of people who care about those old flash games?
I also find it odd that JavaScript is being presented as a more secure option as JS is easily as “dirty” as flash ever was.
Adobe doesn’t need Flash announcements to remain relevant, their business is growing over 20% a year and they raked in over $11 billion last year. Flash has been an irrelevance to them for years.
As for JavaScript, it’s nowhere near as bad as Flash was when it was still in widespread use. Part of that is because of how much better browsers are in general, but even last year, Flash vulnerabilities were reported that could open up your whole OS to malicious software. JavaScript runs in a sandbox, so that level of risk is very unlikely.
At the peak of the Nasdaq bubble adobe traded at 40. Now it’s 400 with just enough cash on the balance sheet offset it’s debt…debt that its doubled in the last two years. Yeah…I see this ending well. There’s a nice book that I gave to my students years ago. Might want to take a look…”Extraordinary Popular Delusions and the Madness of Crowds”. Best of luck, Steven
Agreed about flash vs js. I can’t speak much from a technical perspective, but flash started running in a sandbox many ages ago, first on chrome as I recall, then eventually others followed suit. But whether there are more vulnerabilities in js or not, the web itself is far more dangerous after flash than during it.
In flash’s heyday, all you had to do was block flash. Boom, headshot. 75% of danger (and annoyances) gone. Follow that up by not opening email attachments and not visiting russian domain names, and you’re like 95% safe. In the days of flash, I didn’t even bother with ad blockers, just flashblock. You could even selectively renable primary content, like a hulu video, without exposing yourself to all the potential threats.
After flash, there is no easy safe move, closest would be running all browsing through a virtual machine. Malvertising in particular has spread crippling malware far more broadly than anything flash ever accomplished, and it’s being delivered to end users by the largest, most credible sites, not shady russians, but NYT, BBC, every blog, every site with ads and cross site injected plugins. Between ransomware, cryptominers, and ad fraud (planting programs to mine ad clicks in the background), there’s plenty of motive to exploit whatever the current weak link is, and whatever limited sandboxing is taking place isn’t helping much, not even hospitals and police stations.
adblocking helps, but it’s a cat and mouse game where you just hope whoever maintains your blocklists can keep up with the bad guys. You can’t block scripting today without breaking everything, even the most basic functionality.
Now maybe someone will reply, properly, that it’s the general infrastructure (a tangled web of crosssite injection where no one is accountable for dozens or hundreds of domains that get pushed through a single web page) and the weaving of scripting into every single element through html5 that presents the danger, not one scripting language specifically, whereas flash was more concentrated danger in the flash itself. Whatever, it was still so much easier to stay safe back then. And I’ve no doubt that somewhere some idiot blog like engagdget has a post today celebrating the wonderful security of the post flash era.
From what I’ve seen in different industries, there must be tons of applications that use Flash, most likely on antiquated machines. Kiosks, training and certification sessions that need to be tracked, specific purpose computers with discrete UI, etc. Anything that would need a certain amount of money to re-code in a place that doesn’t want to spend the money to replace it.
“God that thing is ancient, shouldn’t we update that?” “…but it still works!”
Announcements like these are the “WE AREN’T JOKING THIS SOFTWARE IS GOING AWAY YOU SHOULD ALREADY BE DEVELOPING THE REPLACEMENT” wakeup calls that allow tech teams to push their managers and budget teams to approve replacement work and hardware. You’d think it shouldn’t have to come to that by this point, but… yeah.